v2.53.2

Changelog

• 9a6e5b6 fix(cli,agent): ORUN_TOKEN_FILE outranks a frozen env copy; intake asks properly (#614)

v2.53.1

Changelog

• 91f1836 fix(agent): bootstrapper allows the background-task plumbing (#613)

v2.53.0

Changelog

• 9e7e195 feat(agent): bootstrapper type + fix the can_use_tool allow contract (#612)

v2.52.9

Changelog

• fc04345 feat(agent): durable tool_call events carry the call's input (#611)

v2.52.8

Changelog

• 1a92a84 fix(agent): ground empty remotes — unborn HEAD at the ref, not a dead clone (#610)

v2.52.7

ORUN_TOKEN_FILE everywhere

ORUN_TOKEN_FILE (the agent runtime's refreshed-token channel) is now honored by every surface that honors ORUN_TOKEN — cloud/secrets/integrations/workspace verbs and auth status — read lazily per command so short-lived session tokens stay fresh across long sandboxed runs. (#609, epic saas-blueprints-onboarding)

v2.52.6

Bootstrap smoothness (the atlas issues-log batch)

• orun version subcommand (same output as --version).
• orun workspace show/current = the local show; named args still resolve remotely.
• Headless-honest auth: auth status reports ORUN_TOKEN auth instead of 'not logged in'; 'not logged in' errors stop suggesting a token that is already set and explain what it cannot do.
• Secret-write not_found hint names the real cause (role below the ADMIN write floor; resource-hiding masks denials).
• OCI ref resolution retries transient registry 5xx/timeouts (×3, backoff) — a single GHCR 503 no longer kills an apply.

(#608)

v2.52.5

Catalog auto-sync actually publishes

• The auto-publish gate accepts a CLEAN main head that is ALSO tagged (tag-per-release workflows silently disabled auto-sync forever). Every silent precondition skip now reports why under ORUN_VERBOSE.
• Push scope resolves intent-declared project SLUGS to prj_… ids (state routes 404'd on slugs — the same class as #606, in the sync path).
• orun catalog push resolves the backend URL from intent.yaml.

(#607)

v2.52.4

Remote-state scope: project slugs resolve

orun run --remote-state now resolves an intent-declared project: <slug> to its prj_… id — in CI by adopting the OIDC exchange's bound project (authoritative), elsewhere via the projects list. Previously a declared slug 404'd every state route, surfacing as 'this repo isn't connected'. (#606)

v2.52.3

Step timeouts kill the whole process tree

A step's timeout: now terminates the step's entire process group (unix: Setpgid + group SIGKILL; all platforms: WaitDelay=10s pipe backstop). Previously only the direct child died — an orphaned grandchild (e.g. a stalled git fetch, which has no transfer timeout) kept the step's output pipes open and a 15-minute timeout could surface after 71 minutes. (#605)